How can I protect my Partitions and files from damage

alan10 · 02 Feb 2013

My SSD with Windows 7 is O.K. - I can restore backup images.
My Primary SamSung HDD is O.K. - I can restore backup images.
My Secondary WDC HDD is what held my images and they vanished.
Fortunately I have duplicates of most on an external HDD.
I am currently scanning and attempting to recover from the Secondary HDD the few images that were not backed up.

I wish to minimize the risk of a future disaster and would like advice on what I am considering,
and any other suggestions.

My WDC HDD was GPT which I have read is safer than MBR - but that did not work out well for me.
I am thinking of cleaning it and using it as MBR,
especially as Lost Partition Recovery is so much faster and easier on MBR than on GPT disks.
Your comments Please.

If I use Windows Disk Management to make the WDC Disk "Offline" would that protect from a Linux glitch,
or is it only Windows applications and tools that take any notice of Offline/Online settings ?

Would the WDC be better protected if I refrain from allocating drive letters to the partitions on the WDC,
and only access via the alternative Disk Management option "Mount in the following empty NTFS folder" ?

DISASTER BACKGROUND,
One of the problems I wish to avoid - but I am sure there are alternative pathways to destruction.

Windows always Recognises first the WDC HDC as Disc 0
and then the Samsung HDD as Disk 1
and finally the OCZ SSD as Disk 2 (even though it is connected to SATA port 0)

My Secondary WDC HDD was GPT with several partitions.
I booted into a Linux Boot Flash Drive that I had slightly tweaked,
and Linux aborted on start-up and the system restarted so I allowed a normal Windows 7 start-up.
Windows Recognised the WDC HDD as Disk 0
BUT for some reason the GPT style Disc ID was a much shorter MBR style Disc ID.
As usual the Samsung HDD was Disc 1, BUT IT WAS OFFLINE due to a Disk Signature Conflict.
By Launching Macrium Reflect I saw that the WDC HDD was using the same 8 digit signature as the Samsung HDD.

Windows Disk Management shows this WDC HDD as NOW being an MBR DISK with
100 MB Basic RAW Healthy(Active,Primary Partition)
25 GB Basic RAW Healthy(Primary Partition)
25 GB Unallocated
14 GB Free Space
531 GB Unallocated

MiniTool Power Data Recovery v 6.6 is able to perfectly recover 300 GB of files from the 531 GB Unallocated space,
but two of the larger 6.5 GB files have the correct names and sizes but fail the MD5 checksum validation,
so I know that some sparse damage has been done to a little bit of the information on the sectors.

Regards
Alan

alan10 · 04 Feb 2013

Bump

Night Hawk · 04 Feb 2013

Is the WD drive a Sata II or III model drive and plugged into one of the two S3 ports? On the Gigabyte board here seeing a pair of S3 ports both S3 drives are seen as Disk 0 and Disk 1 as you will notice the 1024mb is seen on only the two Sata II drives used for the 7 host and second OS drive in the image here.

One likely explanation for why the images just simply disappeared would be corruption of the Partition Table or Master File Table information resulting in seeing the volume take a nose dive! When going to expand a C volume on an old XP case that saw C shrunk for the 7 RC and later removed the C volume went Poof! gone in a flash! A data/partition recovery program was then needed to restore files lost on the original C primary.

In case of bad sectors or the drive simply going on you the WD LifeGuard diagnostics can reveal if the drive itself is on the way out. It wouldn't be the GPT so much if the drive is found good however but a possible bad event when going to partition and format the drive.

Now as far as...

If I use Windows Disk Management to make the WDC Disk "Offline" would that protect from a Linux glitch,
or is it only Windows applications and tools that take any notice of Offline/Online settings ?

Linux glitch? You would have to be a little more specific about what you are referring to there. If you are booting live from a ubuntu or other cd/dvd which can also be used as a data recovery method you would have to do something yourself to effect any file on any of the drives you have there. Just running a live distro or setting up a dual boot on another drive or two would specifically cause any issue other then possibly seeing Grub installed on the wrong drive.

As for protecting any volume other then the 7 primary you could always elect to see a particular drive or partition encrypted as the usual method of locking up a volume to protect it from changes. But if you should forget the password... oops! reformat time all over again! The Ultimate edition does offer the BitLocker feature.

whs · 04 Feb 2013

There is no 100% protection by any means. Best is to frequently backup. Images for the OS and maybe sync for the data (although I image the data too - is the easiest and can be scheduled).

Night Hawk · 04 Feb 2013

Nothing is ever 100% fool proof! The BitLocker would simply prevent accidental mishaps with the data secured by encryption to be unavailable to the usual access.

It won't protect you from hardware problems however. Once a drive goes belly up call it a day if you didn't already back things up. The best possible approach I think you already realized was having system images on a second external drive as well as on the WD when "something went wrong".

Backing up the backups of the backups is a rule of thought for extending protection on data.

alan10 · 05 Feb 2013

The WDC is SATA II

The Linux Glitch was a failure to launch.
Full details are at posts #31 and #33 in
How to create multi-boot flash drive

As a concise (for me) summary :-

I used YUMI to build an 8 GB Boot Flash Drive with a number of 60 MB and 170 MB Boot ISO's plus a menu to choose which ISO to launch.
It worked well.

I used YUMI to build another 8 GB Boot Flash Drive with only one of the ISO's.
Then rather than repeating the actions many times for each ISO
I copied all the other files which the first Flash Drive held,
and just in case the YUMI mechanism depended upon an MBR tweak that depended upon quantities of ISO's etc.
I used MBRBackup to copy the MBR from the first flash drive to the second.
I also changed the Volume Label so that I could distinguish between the two Flash Drives.

Identical MBR's, Identical Files - nothing can go wrong ... go wrong ... go wrong

I plugged in the renamed duplicate and powered up and booted into it and SysLinux started and then failed
I cannot now remember if I saw the ISO selection menu - I certainly never had the chance to launch one.
I cannot now remember if I had to Ctrl-Alt-Del or whether Linux gracefully collapsed back into a restart.
I definitely remember that the PC restarted as normal into Windows,
but instantly a pop-up complained about a missing Pagefile.sys and that a new one had been created.

Incidentally, Pagefile had been relocated to partition E:\ on the WDC drive which was now RAW.

Somehow the above Linux glitch caused the GPT style WDC HDD to have its GUID Disk Signature replaced by an MBR Disk Signature,
and even worse this replacement MBR Disk Signature exactly corresponded to the MBR Disk Signature of the Samsung HDD which has always been MBR,
and as a result Windows automatically set the SamSung "Offline" which robbed me of partitions D:\ and H:\

I have since used Windows Disk Management to turn the Samsung "Online" and it has been given a new Disk Signature.

I have been able to recover most of the files that were on the WDC with MiniTool Power Data Recovery 6.6
To me the most important files are the Macrium Reflect Image backup files.
Fortunately all but the last few were backed up to an external eSATA drive.
Regrettably most (but not all) of the recovered 6.5 GB files are corrupt, BUT the file sizes are exactly correct.
I suspect that either :-
The files were fragmented and the pieces were not recovered in the correct sequence ; or
Bad stuff happens when Recovery software is copying files that exceed the 4GB FAT32 limit and the source disk was GPT but Windows thinks it is MBR ; or
The Linux Glitch and/or the Windows Unhappiness has caused corruption within every 8 GB of "Used Space" of the odd Bit / Byte / Sector / or Cluster.

Widespread but sparse data destruction happened, and the WDC is now a GPT/MBR mishmash which I assume will need to be cleaned/wiped/initialised before I can use it again.

QUESTIONS :-
If WDC partitions have no drive letters, but are accessed from Samsung via Mountvol or "Mount in the following empty NTFS folder" etc.
would they still be equally vulnerable to whatever has just happened to me ?

I understand GPT has better resilience but it did not work perfectly this time.
Should I again risk using GPT style if a simple Linux Glitch is likely to to again change its Signature to MBR style ?

Below are sundry reports :-

Regards
Alan

DiskPart view

DISKPART> list disk

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 596 GB 571 GB
Disk 1 Online 931 GB 123 GB
Disk 2 Online 55 GB 0 B

DISKPART>

Speccy veiw of WDC

WDC WD6401AALS-00L3B2 ATA Device
Manufacturer Western Digital
Form Factor GB/3.5-inch
Business Unit/Brand Desktop/WD Caviar®
Heads 16
Cylinders 16383
SATA type SATA-II 3.0Gb/s
Device type Fixed
ATA Standard ATA8-ACS
LBA Size 48-bit LBA
Power On Count 5611 times
Power On Time 466.9 days
Features S.M.A.R.T., AAM, NCQ
Transfer Mode SATA II
Interface SATA
Capacity 625GB
Real size 640,135,028,736 bytes
RAID Type None
S.M.A.R.T
01 Read Error Rate 200 (200 worst) Data 0000000000
03 Spin-Up Time 158 (157) Data 00000013E3
04 Start/Stop Count 093 (093) Data 0000001D11
05 Reallocated Sectors Count 200 (200) Data 0000000000
07 Seek Error Rate 100 (253) Data 0000000000
09 Power-On Hours (POH) 085 (085) Data 0000002BC6
0A Spin Retry Count 100 (100) Data 0000000000
0B Recalibration Retries 100 (100) Data 0000000000
0C Device Power Cycle Count 095 (095) Data 00000015EB
C0 Power-off Retract Count 200 (200) Data 000000009C
C1 Load/Unload Cycle Count 198 (198) Data 0000001D11
C2 Temperature 113 (108) Data 0000000022
C4 Reallocation Event Count 200 (200) Data 0000000000
C5 Current Pending Sector Count 200 (200) Data 0000000000
C6 Uncorrectable Sector Count 200 (200) Data 0000000000
C7 UltraDMA CRC Error Count 200 (200) Data 0000000000
C8 Write Error Rate / Multi-Zone Error Rate 200 (200) Data 0000000000
Temperature 34 °C
Temperature Range ok (less than 50 °C)
Status Good
Partition 0
Partition ID Disk #0, Partition #0
Size 100 MB
Partition 1
Partition ID Disk #0, Partition #1
Size 25.0 GB
Partition 2
Partition ID Disk #0, Partition #2
Size 14.7 GB

CrystalDisk view of WDC

----------------------------------------------------------------------------
CrystalDiskInfo 4.3.0 (C) 2008-2012 hiyohiyo
Crystal Dew World : Crystal Dew World
----------------------------------------------------------------------------

OS : Windows 7 Ultimate Edition SP1 [6.1 Build 7601] (x64)
Date : 2013/02/05 10:05:44

-- Controller Map ----------------------------------------------------------
- ATA Channel 1 (1) [ATA]
+ Standard Dual Channel PCI IDE Controller [ATA]
- ATA Channel 0 (0)
- ATA Channel 1 (1)
+ Standard Dual Channel PCI IDE Controller [ATA]
- ATA Channel 0 (0)
- ATA Channel 1 (1)
+ Standard Dual Channel PCI IDE Controller [ATA]
+ ATA Channel 0 (0)
- OCZ-VERTEX2 ATA Device
+ ATA Channel 1 (1)
- WDC WD6401AALS-00L3B2 ATA Device
+ ATA Channel 2 (2) [ATA]
- SAMSUNG HD103SJ ATA Device
+ ATA Channel 3 (3) [ATA]
- TSSTcorp CDDVDW SH-S203P ATA Device
- ATA Channel 0 (0) [ATA]
- ATA Channel 1 (1) [ATA]
- ATA Channel 0 (0) [ATA]
- ATA Channel 1 (1) [ATA]
- ATA Channel 0 (0) [ATA]
+ Standard AHCI 1.0 Serial ATA Controller [ATA]
- ATA Channel 0 (0)
- ATA Channel 1 (1)
- ATA Channel 2 (2)
- ATA Channel 3 (3)

-- Disk List ---------------------------------------------------------------
(1) WDC WD6401AALS-00L3B2 : 640.1 GB [0-7-0, pd1]
(2) SAMSUNG HD103SJ : 1000.2 GB [1-8-0, pd1]
(3) OCZ-VERTEX2 : 60.0 GB [2-6-0, pd1] - sf

----------------------------------------------------------------------------
(1) WDC WD6401AALS-00L3B2
----------------------------------------------------------------------------
Model : WDC WD6401AALS-00L3B2
Firmware : 01.03B01
Serial Number : WD-WMASY3517381
Disk Size : 640.1 GB (8.4/137.4/640.1)
Buffer Size : 32767 KB
Queue Depth : 32
# of Sectors : 1250263728
Rotation Rate : Unknown
Interface : Serial ATA
Major Version : ATA8-ACS
Minor Version : ----
Transfer Mode : SATA/300
Power On Hours : 11206 hours
Power On Count : 5611 count
Temparature : 34 C (93 F)
Health Status : Good
Features : S.M.A.R.T., AAM, 48bit LBA, NCQ
APM Level : ----
AAM Level : 80FEh [ON]

-- S.M.A.R.T. --------------------------------------------------------------
ID Cur Wor Thr RawValues(6) Attribute Name
01 200 200 _51 000000000000 Read Error Rate
03 158 157 _21 0000000013E3 Spin-Up Time
04 _93 _93 __0 000000001D11 Start/Stop Count
05 200 200 140 000000000000 Reallocated Sectors Count
07 100 253 __0 000000000000 Seek Error Rate
09 _85 _85 __0 000000002BC6 Power-On Hours
0A 100 100 __0 000000000000 Spin Retry Count
0B 100 100 __0 000000000000 Recalibration Retries
0C _95 _95 __0 0000000015EB Power Cycle Count
C0 200 200 __0 00000000009C Power-off Retract Count
C1 198 198 __0 000000001D11 Load/Unload Cycle Count
C2 113 108 __0 000000000022 Temperature
C4 200 200 __0 000000000000 Reallocation Event Count
C5 200 200 __0 000000000000 Current Pending Sector Count
C6 200 200 __0 000000000000 Uncorrectable Sector Count
C7 200 200 __0 000000000000 UltraDMA CRC Error Count
C8 200 200 __0 000000000000 Write Error Rate

----------------------------------------------------------------------------

alan10 · 05 Feb 2013

I am thankful my MOBO has no UEFI SECURE BOOT etc capability.
Apparently a Linux Boot Flash can permanently destroy such a computer
Hardware neutrality: UEFI strikes again and again | TechRepublic

gregrocker · 05 Feb 2013

You should run Partition Wizard Partition Recovery Wizard - Video Help before running data recovery. It can reinstate (undeleted) the entire partition intact along with its table.

Test the HD using Data Lifeguard Diagnostic

alan10 · 05 Feb 2013

Thanks

I first used Recovery Wizard to Scan and it found 10 partitions with Volume Labels,
but since Windows was fooled into seeing this as an MBR disk and the partitions were created and populated as GPT I emailed the developers before proceeding.
Support responded the next day to advise that it only works on MBR disks but Power Data recovery works on both MBR and GPT.
So I have used Power Data Recovery which does not write to the disk.
When I have exhausted all possibilities that avoid any disk writes I then intended to try the Recovery Wizard anyway.

I will however follow your advice and use first Lifeguard Diagnostic.

Question :-
If I find the HDD firmware is out of date should I update it before running the Partition Recovery Wizard ?

Regards
Alan

gregrocker · 05 Feb 2013

Thank you for updating us on this Alan. It seems you are very thorough.

A lot to do with the new UEFI BIOS' and their required GPT disks is only coming into the mainstream now, so it challenges the help fixes many of which were developed here and have worked for years with countless thousands of users.

Is this a UEFI BIOS in which you're using Legacy Mode or Compatibility Support Module for dual modes GPT and MBR?